US 11,388,072 B2Granted

Correlating network traffic that crosses opaque endpoints

AssigneeExtraHop Networks, Inc.

InventorsXue Jun Wu, Arindum Mukerji, Jeff James Costlow, Michael Kerber Krause Montague, Jesse Abraham Rothstein, Matthew Alexander Schurr

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Two or more network segments coupled by a traffic forwarding device (TFD) may be monitored. External network addresses and internal network addresses may be determined based on encrypted network traffic exchanged between external endpoints and the TFD and internal network traffic exchanged between internal endpoints and the TFD. Metrics associated with the external network addresses or the internal network addresses may be determined based on the monitoring. Correlation scores may be provided for the external network addresses and the internal network addresses based on of a correlation model, the metrics, or the other metrics. If a correlation score associated with an external network address and an internal network address exceeds a threshold value, the external network address and the internal network address may be associated with each other based on the correlation score.

Claims24

Dependent claims

A method for monitoring network traffic using one or more network monitoring computers, comprising:

monitoring two or more network segments that are coupled by a traffic transformation device (TFD);
determining one or more external network addresses and one or more internal network addresses based on encrypted network traffic exchanged between one or more external endpoints and the TFD and internal network traffic exchanged between one or more internal endpoints and the TFD, wherein the internal network traffic is non-encrypted;
determining one or more metrics associated with the one or more external network addresses and one or more other metrics associated with the one or more internal network addresses based on the encrypted network traffic exchanged between one or more external endpoints and the TFD and the non-encrypted internal network traffic exchanged between one or more internal endpoints and the TFD;
providing one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more of a correlation model, the one or more metrics, or the one or more other metrics;
and
in response to a correlation score associated with an external network address and an internal network address exceeding a threshold value, performing further actions, including:
associating the external network address and the internal network address with each other based on the correlation score;
and
providing a report that includes information about an association of the external network address with the internal network address.

6 more elements

A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more networking monitoring computers perform a method comprising:

monitoring two or more network segments that are coupled by a traffic forwarding device (TFD);
determining one or more external network addresses and one or more internal network addresses based on encrypted network traffic exchanged between one or more external endpoints and the TFD and internal network traffic exchanged between one or more internal endpoints and the TFD, wherein the internal network traffic is non-encrypted;
determining one or more metrics associated with the one or more external network addresses and one or more other metrics associated with the one or more internal network addresses based on the encrypted network traffic exchanged between one or more external endpoints and the TFD and the internal network traffic exchanged between one or more internal endpoints and the TFD;
providing one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more of a correlation model, the one or more metrics, or the one or more other metrics;
and
in response to a correlation score associated with an external network address and an internal network address exceeding a threshold value, performing further actions, including:
associating the external network address and the internal network address with each other based on the correlation score;
and
providing a report that includes information about an association of the external network address with the internal network address.

6 more elements

A system for monitoring network traffic in a network:

one or more network monitoring computers (NMCs), comprising:
a transceiver that communicates over the network;
a memory that stores at least instructions;
and
one or more processors that execute instructions that perform actions, including:
monitoring two or more network segments that are coupled by a traffic forwarding device (TFD);
determining one or more external network addresses and one or more internal network addresses based on encrypted network traffic exchanged between one or more external endpoints and the TFD and internal network traffic exchanged between one or more internal endpoints and the TFD, wherein the internal network traffic is non-encrypted;
determining one or more metrics associated with the one or more external network addresses and one or more other metrics associated with the one or more internal network addresses based on the encrypted network traffic exchanged between one or more external endpoints and the TFD and the internal network traffic exchanged between one or more internal endpoints and the TFD;
providing one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more of a correlation model, the one or more metrics, or the one or more other metrics;
and
in response to a correlation score associated with an external network address and an internal network address exceeding a threshold value, performing further actions, including:
associating the external network address and the internal network address with each other based on the correlation score;
and
providing a report that includes information about an association of the external network address with the internal network address;
and
one or more client computers, comprising:
a transceiver that communicates over the network;
a memory that stores at least instructions;
and
one or more processors that execute instructions that perform actions, including:
providing one or more portions of the encrypted network traffic.

18 more elements

A network monitoring computer (NMC) for monitoring network traffic between one or more computers, comprising:

a transceiver that communicates over the network;
a memory that stores at least instructions;
and
one or more processors that execute instructions that perform actions, including:
monitoring two or more network segments that are coupled by a traffic forwarding device (TFD);
determining one or more external network addresses and one or more internal network addresses based on encrypted network traffic exchanged between one or more external endpoints and the TFD and internal network traffic exchanged between one or more internal endpoints and the TFD, wherein the internal network traffic is non-encrypted;
determining one or more metrics associated with the one or more external network addresses and one or more other metrics associated with the one or more internal network addresses based on the encrypted network traffic exchanged between one or more external endpoints and the TFD and the internal network traffic exchanged between one or more internal endpoints and the TFD;
providing one or more correlation scores for the one or more external network addresses and the one or more internal network addresses based on one or more of a correlation model, the one or more metrics, or the one or more other metrics;
and
in response to a correlation score associated with an external network address and an internal network address exceeding a threshold value, performing further actions, including:
associating the external network address and the internal network address with each other based on the correlation score;
and
providing a report that includes information about an association of the external network address with the internal network address.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/337,299Filed 2 Jun 2021 · continuation in part
Priority: 5 Aug 2019
Published: US 2021/0194781 A116 Sep 2021
Granted: 12 Jul 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04L 43/026
Capturing of monitoring data: using flow identification
H04L 43/062
Generation of reports: related to network traffic
H04L 43/08
Arrangements for monitoring or testing data switching networks: monitoring or testing based on specific metrics, e.g. QoS, energy consumption or…
H04L 43/12
Arrangements for monitoring or testing data switching networks: network monitoring probes

Family

Application16/532,275Parent of this continuation · filed 5 Aug 2019
Application16/989,025Parent of this continuation-in-part · filed 10 Aug 2020
US 10,742,530 B1Parent of this continuation · filed 11 Aug 2020
US 2021/0288895 A1Pre-grant publication · published 16 Sep 2021
Application16/989,025Parent of this continuation
US 11,438,247 B2Related patent
US 2021/0194781 A1Published application
US 11,388,072 B2This patent

From the US filing history. Foreign family members aren’t listed.